Re: [cti-stix] STIX 2.0 - Bundle and collection of arbitrary STIX objects - improvement?

[Allan Thomson <athomson@lookingglasscyber.com>]

Hi Alexandre – I agree and had advocated for a similar approach as you suggest natively in STIX too.

That is, having a manifest concept in STIX files.

Regarding best practices. Creating a manifest files and a set of ‘bundled’ files was how we dealt with the large content issue in our products. The content was JSON just not STIX.

The response from the community in the past has been that the manifest approach is better served by the transport mechanism such as TAXII.

I’m not sure I agree with that answer but have decided that its easier to just create a custom top-level object for the manifest concept and then use that mechanism. Its not ideal as its not a standard approach but it would work for sharing across products that do need to have a similar mechanism.

allan



On 8/18/16, 11:55 PM, "cti-stix@lists.oasis-open.org on behalf of Alexandre Dulaunoy" <cti-stix@lists.oasis-open.org on behalf of Alexandre.Dulaunoy@circl.lu> wrote:

    Hi All,

    While reading the STIX 2.0 document, I would like to share with you a current
    issue we have with large set of STIX objects or packages (v1.1). Large objects are becoming
    more common in threatintel sharing platforms. We have seen a significant grow in the MISP
    instances that we know about of indicators or additional information like malware samples.

    The section 7. mentions the use of bundle which improves the situation while exchanging
    over non-TAXII interfaces. It's indeed an improvement but we saw many limitations with
    current JSON parsers which are often non-stream based and load the whole JSON structure in
    memory. Could we extend the use of bundle to have a simple MANIFEST file approach
    where the STIX objects are only referenced in the bundle without adding the full object by itself?
    This would avoid the parsing of the full JSON object and having a simple way to create
    bundle in packages (like ZIP, tar.gz...) with each STIX objects as file.

    Thank you very much.

    Cheers.

    PS: Also, we would be very interested on hearing about best-practices when it comes to sharing large datasets in STIX 1.1/1.2.


    --
    Alexandre Dulaunoy
    CIRCL - Computer Incident Response Center Luxembourg
    41, avenue de la gare L-1611 Luxembourg
    info@circl.lu - www.circl.lu

    ---------------------------------------------------------------------
    To unsubscribe from this mail list, you must leave the OASIS TC that
    generates this mail.  Follow this link to all your TCs in OASIS at:
    https://www.oasis-open.org/apps/org/workgroup/portal/my_workgroups.php